The Café Wi-Fi Session
A sales representative is working from a café and connects a company laptop to the café's free Wi-Fi to check email and upload a client proposal to the company's cloud storage. The café network has no password. The laptop's firewall is on, but the sales rep has previously disabled HTTPS-only mode in the browser to reach an old internal site. The proposal contains client pricing. The rep also uses the same café network to log into a personal social media account. The company laptop has full-disk encryption and a screen lock set to 5 minutes. The rep leaves the laptop open and unattended for 12 minutes while queuing for coffee.
1. Assess the risks to confidentiality in this scenario, distinguishing between network risks and physical risks.
Read the worked answer
Network risks:
- The café Wi-Fi is open (no password), so traffic is not protected at the network layer. On an open network, others can potentially eavesdrop or run man-in-the-middle attacks.
- HTTPS-only mode has been disabled, so some traffic may travel unencrypted, exposing the client proposal and login credentials.
- Logging into a personal social account on the same untrusted network widens exposure and mixes personal and work activity.
Physical risks:
- The laptop is left open and unattended for 12 minutes. Anyone passing could read the screen, plug in a USB device, or take the machine.
- The 5-minute screen lock helps only if the machine actually locks; an open, active session may still be visible before lock triggers, and a passer-by can see the screen in the meantime.
What is already controlled: Full-disk encryption protects data if the laptop is stolen and powered off; the firewall limits inbound connections. These reduce but do not remove the risks above.
2. Recommend practical mitigations the rep could apply immediately, and one policy change for the company.
Read the worked answer
Immediate mitigations:
- Re-enable HTTPS-only mode and avoid any HTTP site for work.
- Use the company VPN if one exists, so traffic is encrypted regardless of the café network.
- Do not log into personal accounts on the work laptop on an untrusted network.
- Keep the laptop with you or lock the screen (manually) before leaving; never leave it open and unattended.
- Prefer a phone hotspot over open Wi-Fi where possible.
Policy change: Require a VPN (or prohibit open Wi-Fi) for accessing company cloud storage and email from outside the office, and enforce HTTPS-only via device management so individuals cannot disable it. This removes reliance on the individual remembering to behave safely.